Fix label_updated_at reset

[JordanMontgomery]

Related issue: Resolves #

Resets label_updated_at to the "never" sentinel (2000-01-01 UTC) so that the exclude-any dynamic-label guard treats the cleared memberships as not-yet-reported instead of trusting them until the next label report.

Prior to this fix, hosts could see profiles get installed on enrollment, then relatively quickly removed once labels actually got calculated, as opposed to having them withheld until the exclude label query could be ran.

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

• Timeouts are implemented and retries are limited to avoid infinite loops

• If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

• Added/updated automated tests

• Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)

• QA'd all new/changed functionality manually

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where profiles with exclude-any labels could be installed before label results were available after DEP re-enrollment.
  • Label status now resets correctly during re-enrollment while preserving unaffected hosts’ label information.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.36%. Comparing base (d2fe9be) to head (0f99185).
⚠️ Report is 135 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #50845      +/-   ##
==========================================
+ Coverage   68.27%   68.36%   +0.08%     
==========================================
  Files        3949     3959      +10     
  Lines      252620   255312    +2692     
  Branches    13328    13328              
==========================================
+ Hits       172485   174548    +2063     
- Misses      64700    65151     +451     
- Partials    15435    15613     +178     

Flag	Coverage Δ
backend	69.63% <100.00%> (+0.07%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JordanMontgomery]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2aaebfa5-8c0f-4f7e-be7e-092d9e9710fc

📥 Commits

Reviewing files that changed from the base of the PR and between 6ae6d11 and 0f99185.

📒 Files selected for processing (3)

• changes/fix-apple-mdm-reset-label-updated-at
• server/datastore/mysql/apple_mdm.go
• server/datastore/mysql/apple_mdm_test.go

---

Walkthrough

Apple MDM re-enrollment reset now sets the host’s label_updated_at to the default non-zero timestamp after restoring builtin label memberships. Database errors continue through the existing reset flow. Tests verify reset behavior, unaffected hosts, and failed resets for nonexistent hosts. A changelog entry documents the fix.

Possibly related PRs

• fleetdm/fleet#50287: Both modify MDMAppleResetOnReenrollment and its tests.
• fleetdm/fleet#50493: The timestamp reset complements its shared unknown-label reconciliation changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the fix but leaves the related issue blank and all applicable checklist and testing items unchecked.	Add or remove the related issue reference and complete the applicable checklist items, including confirmation of automated tests and manual QA.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change to reset label_updated_at.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch JM-reset-dep-label-updated-at

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}